1. Field
Various examples relate generally to device authentication and more particularly to off-line authentication of limited resource devices.
2. Background
Public-key cryptography systems are implemented in devices, including portable devices, to enhance data security and generate cryptographic signatures that can be employed in connection with device and/or user authentication. Public-key cryptography systems provide a user with a private key and a public key for authentication purposes, wherein the public key is shared with disparate users and/or devices while the private key is concealed to all except an assigned user and/or device. In more detail, if the user and/or device requests access to a disparate device, the public key can be delivered to one or more targeted entities while the private key is retained within the device and concealed from the device to which access is requested. In this manner, the device can be utilized by an owner thereof to establish relationships with targeted entities, thus providing the owner access to secured items, including doors, bank accounts, computer networks, etc.
When a service technician desires access to mobile devices for servicing purposes, a short service programming code (SPC) typically common to all devices on a service provider's network is utilized. An SPC is a secret number that allows reprogramming of user information and is employed to prevent companies, other than the original sales company, from having the ability to program the device. Technicians employed by the service provider, however, utilize the code to access and program a  mobile device, causing issues with respect to security, as there is no method of revoking the service programming code. It is not practicable to provide every service technician a conventional username and password, to overcome security concerns, as providing a unique username and password may require hundreds or thousands of username-password pairs to be provisioned on every device. In the case of limited resource devices, this is not possible due to the limited resources.
Hence, it would be desirable to have a method or device for granting authenticated access to off-line, limited-resource mobile devices.